To: 


Of: 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


ENFORCEMENT NOTICE 


Argentum Data Solutions Limited 


27 Sheet Street, Windsor, Berkshire, England, SL4 1BN 


The Information Commissioner (“the Commissioner”) is minded to 
issue Argentum Data Solutions Limited (“ADS”) with an enforcement 
notice under section 40 of the Data Protection Act 1998 (“DPA”). The 
notice is being issued because of a serious contravention of Regulation 
22 of the Privacy and Electronic Communications (EC Directive) 
Regulations 2003 (“PECR”). 


This notice explains the Commissioner’s decision. 


Legal framework 


ADS, whose registered office is given above (Companies House 
Registration Number: 08935427) is the organisation stated in this 
notice to have transmitted unsolicited communications by means of 
electronic mail to individual subscribers for the purposes of direct 
marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR states: 


"(1) This regulation applies to the transmission of unsolicited 
communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 
the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 
products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 
communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 


5. Regulation 23 of PECR states that "A person shall neither transmit, nor 
instigate the transmission of, a communication for the purposes of 
direct marketing by means of electronic mail - 


(a) where the identity of the person on whose behalf the 
communication has been sent has been disguised or 
concealed; 


(b) where a valid address to which the recipient of the 
communication may send a request that such 
communications cease has not been provided 


(c) where that electronic mail would contravene regulation 7 of 
the Electronic Commerce (EC Directive) Regulations 2002; 


or 


(d) where that electronic mail encourages recipients to visit 
websites which contravene that regulation.” 


6. Section 122(5) of the Data Protection Act 2018 “DPA18” defines direct 
marketing as “the communication (by whatever means) of advertising 
or marketing material which is directed to particular individuals”. This 
definition also applies for the purposes of PECR (see regulation 2(2) 
PECR and paragraphs 430 & 432(6) to Schedule 19 of the DPA18). 


Ts From 1 January 2021, consent in PECR has been defined by reference 
to the concept of consent in the UK GDPR as defined in section 3(10) of 
the DPA 2018!4]: see regulation 2(1) of PECR, as amended by Part 3 of 
Schedule 3, paragraph 44 of The Data Protection, Privacy and 


0 The UK GDPR is therein defined as Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 
April 2016 (“GDPR”) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue 
of section 3 of the European Union (Withdrawal) Act 2018. 


S 


10. 


able 


T2 


Electronic Communications (Amendments etc) (EU Exit) Regulations 
2019/419. Article 4(11) of the UK GDPR sets out the following 
definition: “'consent’ of the data subject means any freely given, 
specific, informed and unambiguous indication of the data subject's 
wishes by which he or she, by a statement or by a clear affirmative 
action, signifies agreement to the processing of personal data relating 
to him or her”. 


Recital 32 of the UK GDPR materially states that "When the processing 
has multiple purposes, consent should be given for all of them”. Recital 
42 materially provides that "For consent to be informed, the data subject 
should be aware at least of the identity of the controller”. Recital 43 
materially states that “Consent is presumed not to be freely given if it 
does not allow separate consent to be given to different personal data 
processing operations despite it being appropriate in the individual case”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 
and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 
communications services for the supply of such services”. 


“Electronic mail” is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient’s terminal equipment until it is collected by the recipient and 
includes messages sent using a short message service”. 


The DPA contains enforcement provisions at Part V which are 
exercisable by the Commissioner. Those provisions are modified and 
extended for the purposes of PECR by Schedule 1 PECR. 
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13. 


14. 


15; 


16. 


17, 


18. 


Section 40(1)(a) of the DPA (as extended and modified by PECR) 
provides that if the Commissioner is satisfied that a person has 
contravened or is contravening any of the requirements of the 
Regulations, he may serve him with an Enforcement Notice requiring 
him to take within such time as may be specified in the Notice, or to 
refrain from taking after such time as may be so specified, such steps 
as are so specified. 


PECR were enacted to protect the individual's fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 
rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


The contravention 


The Commissioner finds that ADS contravened regulations 22 and 23 of 
PECR. 


The Commissioner finds that the contravention was as follows: 


The Commissioner finds that between 1 January 2021 and 31 January 
2022 there were 2,330,423 direct marketing SMS messages received 
by subscribers. The Commissioner finds that of those 2,330,423 
messages ADS sent 24,309 (regulation 22(3) and allowed its lines to 
be used, by others, to send 2,306,114 direct marketing messages, 
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19. 


20. 


ži. 


22. 


23. 


thereby 2,330,423 messages were sent contrary to regulation 22 of 
PECR. 


ADS, as the sender of the direct marketing, is required to ensure that it 
is acting in compliance with the requirements of regulation 22 of PECR, 
and to ensure that valid consent to send those messages had been 


acquired. 


For consent to be valid it is required to be “freely given”, by which it 
follows that if consent to marketing is a condition of subscribing to a 
service, the organisation will have to demonstrate how the consent can 
be said to have been given freely. 


Consent is also required to be “specific” as to the type of marketing 
communication to be received, and the organisation, or specific type of 


organisation, that will be sending it. 


Consent will not be “informed” if individuals do not understand what 
they are consenting to. Organisations should therefore always ensure 
that the language used is clear, easy to understand, and not hidden 
away in a privacy policy or small print. Consent will not be valid if 
individuals are asked to agree to receive marketing from “similar 
organisations”, “partners”, “selected third parties” or other similar 


generic description. 


In this instance, ADS has not provided any evidence of consents it had 
obtained from individuals prior to sending direct marketing SMS 
messages or allowing other companies to send such from their i 
zs account. Instead, ADS refers to ‘legitimate interest’ as the lawful 
basis for its actions which is contrary to the express requirement for 


consent in Regulation 22 of PECR. 
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24. The Commissioner is therefore satisfied from the evidence he has seen 
that ADS did not have the necessary valid consent for the 2,330,423 
direct marketing messages received by subscribers. 


25. The Commissioner is further satisfied that the actions of ADS have 
contravened Regulation 23 PECR. This is because none of the SMS 
messages which ADS is responsible for sending identified the sender of 


such communication. 


26. The Commissioner has considered, as he is required to do under 
section 40(2) of the DPA (as extended and modified by PECR) when 
deciding whether to serve an Enforcement Notice, whether any 
contravention has caused or is likely to cause any person damage. The 
Commissioner has decided that it is unlikely that damage has been 
caused in this instance. 


27. In view of the matters referred to above the Commissioner hereby 
gives notice that, in exercise of his powers under section 40 of the 
DPA, he requires ADS to take the steps specified in Annex 1 of this 
Notice. 


Right of Appeal 
28. There is a right of appeal against this Notice to the First-tier Tribunal 


(Information Rights), part of the General Regulatory Chamber. 
Information about appeals is set out in the attached Annex 2. 


Dated the 26th day of October 2023 


Signed .. 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 SAF 


ANNEX 1 
TERMS OF THE ENFORCEMENT NOTICE 
ADS shall within 30 days of the date of this notice: 
e Except in the circumstances referred to in paragraph (3) of 


regulation 22 of PECR, neither transmit, nor instigate the 
transmission of, unsolicited communications for the purposes of 


direct marketing by means of electronic mail unless the recipient of 


the electronic mail has previously notified ADS that he clearly and 
specifically consents for the time being to such communications 


being sent by, or at the instigation of, ADS. 


e Furthermore, ADS shall neither transmit, nor instigate the 
transmission of, a communication for the purposes of direct 
marketing by means of electronic mail: 


(a) where the identity of the person on whose behalf the 
communication has been sent has been disguised or 


concealed; 


(b) where a valid address to which the recipient of the 
communication may send a request that such 
communications cease has not been provided 


(c) where that electronic mail would contravene regulation 7 of 


the Electronic Commerce (EC Directive) Regulations 2002; 


or 


(d) where that electronic mail encourages recipients to visit 


websites which contravene that regulation. 


ANNEX 2 


RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


i; Section 48 of the Data Protection Act 1998 gives any person upon 
whom an enforcement notice has been served a right of appeal to the 
First-tier Tribunal (Information Rights) (the “Tribunal”) against the 


notice. 


A If you decide to appeal and if the Tribunal considers:- 


a) that the notice against which the appeal is brought is not in 
accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that he ought to have exercised his discretion 
differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 
Tribunal will dismiss the appeal. 


eA You may bring an appeal by serving a notice of appeal on the Tribunal 
at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 


Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 
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e The notice of appeal should be served on the Tribunal within 28 
days of the date on which the enforcement notice was sent 


The statutory provisions concerning appeals to the First-tier Tribunal 
(General Regulatory Chamber) are contained in sections 48 and 49 of, 
and Schedule 6 to, the Data Protection Act 1998, and Tribunal 
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 
2009 (Statutory Instrument 2009 No. 1976 (L.20)). 


